Bug 1049 - Variable delay in password logins to fight dictionary attacks
Summary: Variable delay in password logins to fight dictionary attacks
Status: CLOSED WONTFIX
Alias: None
Product: Portable OpenSSH
Classification: Unclassified
Component: sshd (show other bugs)
Version: 3.8.1p1
Hardware: ix86 Linux
: P2 enhancement
Assignee: Assigned to nobody
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2005-05-31 21:04 AEST by Heikki Levanto
Modified: 2006-10-07 11:40 AEST (History)
0 users

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Heikki Levanto 2005-05-31 21:04:54 AEST
I have seen many dictionary attacks on my ssh servers. I was thinking of a simple way to slow 
them down: Add a small delay to the login. Start with a half second, and double every time a 
password-based (or other) login fails from the same IP address, up to some limit. 
 
This requires keeping a small array in memory, with each IP address that has recently failed 
to log in, delay time, and a time stamp when a login from them will be allowed again. 
 
In a similar way, it should be possible to keep a time-out for each username, again doubling it. 
At a login, take the greater of the two delays.  
 
Both tables can be limited to (say) 10000 entries, and if they flow over, discard oldest entries. 
Actually, this could also be used for logins that do not try passwords, in case someone tries to 
brute-force something else... 
 
Possibly this is a well-known theory, and there is a well-known reason not to use it. If so, I'd 
like to hear about it.
Comment 1 Damien Miller 2005-06-03 12:13:02 AEST
This doesn't fit well with ssh's process model and would add quite a bit of
complexity for pretty marginal gain. On the other hand, it could easily be
implemented as a small program that watches logs and sets up firewall rules.

Please see the extended discussion on this topic on the
openssh-unix-dev@mindrot.org mailing list.
Comment 2 Darren Tucker 2005-06-03 12:21:18 AEST
BTW it can also be implemented in the underlying auth systems that sshd uses, eg
LinuxPAM has pam_fail_delay.  See:
http://www.kernel.org/pub/linux/libs/pam/Linux-PAM-html/pam_appl-3.html#the-failure-delay-function
and for a way to set this in the PAM config files:
http://www.zip.com.au/~dtucker/patches/pam_faildelay.c
Comment 3 Darren Tucker 2006-10-07 11:40:35 AEST
Change all RESOLVED bug to CLOSED with the exception of the ones fixed post-4.4.